commit e550f2b2b4aab4c5f12db89d04d8978ce4ed7b4e Author: Milan P. Gandhi Date: Thu Nov 5 17:54:01 2026 +0530 scsi: mpi3mr: Validate reply frame size bounds Firmware provides reply_frame_size in dwords, which the driver multiplies by 4 to compute facts.reply_sz (u16). If the reported size exceeds U16_MAX / 4, the multiplication overflows u16 before assignment, causing under-allocated DMA reply buffers. Furthermore, several paths assume a minimal reply frame size: - logdata_entry_sz calculations underflow or hit zero when reply_sz <= 20 bytes, leading to zero-size allocations and divide-by-zero crashes. - Unsolicited status descriptors and fixed replies (such as struct mpi3_iounit_control_reply, 64 bytes) require at least 16 dwords. Validate reply_frame_size in mpi3mr_issue_iocfacts() to ensure it is within [16, U16_MAX / 4] dwords before processing facts data. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Cc: stable@vger.kernel.org Signed-off-by: Milan P. Gandhi Link: https://patch.msgid.link/20261105122401.266559-1-mgandhi@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 08f08a6d49efc422258edba802faa4fc7677309e Author: Ciro Iriarte Date: Sat Oct 31 22:21:39 2026 -0300 scsi: target: core: Parse APTPL res_type and res_scope as hex core_scsi3_update_aptpl_buf() saves the reservation holder's type and scope to the APTPL metadata file as zero-padded hex ("res_type=%02x", "res_scope=%02x"), but target_pr_res_aptpl_metadata_store() reads them back with "%d" tokens and match_int(), which parse with base 0. A leading zero selects octal, so match_token() parses only the "0" of "res_type=08", the trailing "8" makes the token not match, and the field is ignored as unknown. An Exclusive Access - All Registrants holder (type 0x8) is left with type 0 and the write fails with -EINVAL and Illegal PR type: 0x00 for reservation holder Userspace that restores APTPL state by writing the saved records back to pr/res_aptpl_metadata (rtslib-fb does this when it recreates a storage object) therefore loses every type 8 reservation across a target restart, and with rtslib the storage object creation fails. The other valid types (1, 3, 5, 6, 7) and scope 0 only work because their octal and decimal values coincide. Keep the on-disk format and parse both fields as hex. The valid type and scope values have the same hex and decimal representation, so records written in decimal by hand keep working. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Cc: stable@vger.kernel.org Signed-off-by: Ciro Iriarte Link: https://patch.msgid.link/ea903e6c-09b5-4a11-80e8-6e1387f39ef5@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 48d3b732e5ad3fffe74e033d9a3cf47ebaa314b0 Author: Praneeth Balasubramanian Date: Thu Oct 29 13:54:56 2026 -0700 scsi: target: iscsi: Check for existing sessions only after authentication In the operational-negotiation path (CSG=1), iscsi_target_handle_csg_one() calls iscsi_target_check_for_existing_instances() before iscsi_conn_authenticated(). An initiator can therefore send a first Login PDU with CSG=1, TSIH=0 and no CHAP exchange, carrying the InitiatorName and ISID of an existing session. The target reinstates that session, which tears down the legitimate initiator's connection. Only afterwards does it reject the login with AUTH_FAILED. iscsi_check_for_session_reinstatement() matches on ISID, InitiatorName and SessionType only. The InitiatorName is not secret, and open-iscsi ISIDs are a fixed OUI followed by a small session counter. A remote peer with no credentials can thus repeatedly disconnect a CHAP-authenticated session and keep its I/O failing. The comment above iscsi_target_check_for_existing_instances() already states the intended invariant: NOTE: We check for existing sessions or connections AFTER the initiator has been successfully authenticated in order to protect against faked ISID/TSIH combinations. The security-negotiation path (CSG=0) honours this, calling the check only once authentication completes. Move the CSG=1 call below the authentication check so both paths behave the same. When authentication is not required, iscsi_conn_authenticated() returns true and behaviour is unchanged. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Cc: stable@vger.kernel.org Signed-off-by: Praneeth Balasubramanian Link: https://patch.msgid.link/20261029205456.1211532-1-praneethb2002@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 612293fb469c81408829e6325bae25725968986f Author: Boyan Liu Date: Wed Oct 28 14:16:51 2026 +0800 scsi: sd_zbc: Cap zone report count by buffer size sd_zbc_report_zones() limits descriptor parsing to the requested zone count and the device-reported ZONE LIST LENGTH, but not to the number of descriptors that fit in the allocated report buffer. A malicious or malfunctioning device can report an oversized length and cause out-of-bounds reads while the descriptors are parsed: BUG: KASAN: slab-out-of-bounds in sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256) Read of size 8 at addr ffff88802c8d2610 by task kworker/u8:2/37 Call Trace: sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256) blk_revalidate_disk_zones (block/blk-zoned.c:2354) sd_zbc_revalidate_zones (drivers/scsi/sd_zbc.c:566) sd_revalidate_disk (drivers/scsi/sd.c:3898) sd_probe (drivers/scsi/sd.c:4101) Cap the descriptor count with min3() over the remaining requested zones, the device-reported count, and max_in_buf derived from buflen. This matches nvme_ns_report_zones() and preserves iteration over reports that require multiple commands. Use shared constants for the REPORT ZONES header and zone descriptor sizes. [mkp: define constants] Fixes: d41003513e61 ("block: rework zone reporting") Cc: stable@vger.kernel.org Reported-by: co+4a4f9998e2b4b490@bugs.sh Signed-off-by: Boyan Liu Link: https://patch.msgid.link/20261028061651.110435-1-yymhvert@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 46846939d5f33c9333612662c52475f92e753407 Author: Shao Mingyin Date: Mon Oct 26 19:54:09 2026 +0800 scsi: rdac: Keep the error status when controller lookup fails initialize_controller() records SCSI_DH_RES_TEMP_UNAVAIL when get_controller() fails, but then overwrites it with SCSI_DH_OK unconditionally. It therefore reports success with h->ctlr == NULL and rdac_bus_attach() continues with check_ownership(), which dereferences h->ctlr: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... check_ownership rdac_bus_attach get_controller() only fails when its GFP_ATOMIC allocation fails, so the crash happens exactly when memory is already scarce. Only report success after the controller was found and the device was added to its list. Fixes: 327825574132 ("scsi_dh_rdac: switch to scsi_execute_req_flags()") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026195409354OWEI2b6HO7swSphvv1FOc@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit c0bb6614132c64205a3c40c32dc1494c1bfeffe1 Author: Shao Mingyin Date: Mon Oct 26 19:51:33 2026 +0800 scsi: target: Fix NULL pointer dereference in core_alua_do_port_transition() core_alua_do_port_transition() assumes that the device has an ALUA LU group member and that the member is associated with an LU group. Neither is guaranteed: internal-use HBAs never allocate dev_alua_lu_gp_mem, and the association with an LU group is dropped when "NULL" is written to the device's alua_lu_gp attribute. The configfs path can reach the second case. After clearing the LU group association, writing the implicit ALUA access state of a target port group calls core_alua_do_port_transition(), which dereferences the NULL lu_gp in atomic_inc(&lu_gp->lu_gp_ref_cnt). Return -ENODEV when the device has no LU group association instead. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026195133237y2UxJLoV1FK6aD1zrFbIU@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit fe5988e8708e1d42cb844bd9ac8f0a51388061fc Author: Shao Mingyin Date: Mon Oct 26 19:49:55 2026 +0800 scsi: target: Fix NULL pointer dereference in target_dev_alua_lu_gp_store() Writing "NULL" to the alua_lu_gp attribute clears the ALUA LU group association of a device. The attribute can be written again after the association has already been cleared. In that case lu_gp_mem->lu_gp and lu_gp_new are both NULL, but the code still calls __core_alua_attach_lu_gp_mem(), which dereferences the NULL lu_gp pointer: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... __core_alua_attach_lu_gp_mem target_dev_alua_lu_gp_store Clearing an already cleared association is a no-op, so return early when there is no association left to clear. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026194955694FnXGoQ352dstLk5HPBqCG@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit b3da73f09499b34faf5c43c50e1d09e4286226de Author: Joonhoe Kim <26rote@gmail.com> Date: Fri Oct 23 01:50:06 2026 +0900 scsi: ufs: qcom: Reprogram ESI after a host controller reset ufs_qcom_config_esi() returns early once the ESI interrupts are set up. ufshcd_config_mcq() also calls it after every host controller reset, which clears the ESI base address, the vector mask and ESI enable. After the error handler has reset the controller, the completions then arrive only on the legacy interrupt while mcq_esi_enabled stays set. Allocate the MSIs and request their interrupts only once, but program the ESI registers on every call. The MSI message is not cached for platform MSIs, so keep the one written at allocation. Fixes: 519b6274a777 ("scsi: ufs: qcom: Add MCQ ESI config vendor specific ops") Signed-off-by: Joonhoe Kim <26rote@gmail.com> Link: https://patch.msgid.link/20261022165006.1275-1-26rote@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e510b597d8afca2e790e2b5429bc5e01e3386f65 Author: Kiwoong Kim Date: Fri Nov 6 13:12:47 2026 +0900 scsi: ufs: mcq: Poll OCS after sq cleanup for device management commands Extend ufshcd_mcq_sq_cleanup() to poll the OCS field in the UTRD of a device management command after a successful SQ_CUS poll. UFSHCI does not specify the order between the OCS update and the SQ_CUS update, so OCS may still be stale when cleanup returns. Without this poll, a late response to a timed-out query can arrive while a retry is already in flight, leaving the host controller with two query contexts and raising IS.UTPES. Here is the timeline of an actual case I found with kernel 6.18: 1. The driver sent a query but the device didn't respond to it for a long time. [ 7384.156142] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_mcq_sq_cleanup, hwq 0: cleanup return code (RTC) 0 [ 7384.156154] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = -11 2. So after the query timed out, the driver did SQ cleanup. Then the host controller updated the CQ tail and raised IS.CQES. Unfortunately, complete() was called by the driver's ISR afterward. 3. The driver started to retry the query. In the meantime, it set OCS to 0xF. Then the driver didn't wait for completion due to the previous complete() call, and just checked OCS. [ 7384.156163] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = 15 4. The driver retried the query again, but the device didn't return anything, so the query also timed out. [ 7385.660108] [3: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = -11 5. A few seconds later, the device returned the response of the first query, but since the host controller was holding two query contexts and couldn't handle it, it raised IS.UTPES. The same problem exists in the current code. If the query times out, the SCSI error handler calls ufshcd_abort() -> ufshcd_mcq_abort() -> ufshcd_mcq_sq_cleanup(), the request is finished, and the retry reuses the same reserved tag, struct scsi_cmnd and devman UCD. A late CQE for the first query then maps to the same tag and completes the retry by calling scsi_done() too early. The retry then returns the OCS of the first query and, if that OCS is OCS_SUCCESS, its response as well. Hence ufshcd_mcq_sq_cleanup() must not return until the CQE of the cleaned-up request has been processed. The poll is limited to device management commands because ufshcd_compl_one_cqe() copies the OCS from the CQE into the UTRD only for them. For SCSI commands, the OCS in the UTRD stays OCS_INVALID_COMMAND_STATUS, so polling it would always time out. The poll waits until OCS is no longer OCS_INVALID_COMMAND_STATUS or MCQ_POLL_US elapses. -ETIMEDOUT is returned only if OCS is still OCS_INVALID_COMMAND_STATUS after the poll. Any other value, such as OCS_ABORTED reported by the host controller for the cleaned-up request, means the cleanup has completed. The UFSHCI specification says "The host controller shall free up any resources associated to the nexus, and shall post a Completion Queue entry with OCS = ABORTED if clean up successful." Each poll iteration reaps the CQ with ufshcd_mcq_poll_cqe_lock() before reading the OCS, as ufshcd_clear_lu_cmds() does after ufshcd_clear_cmd(). This removes the dependency on interrupt delivery. Otherwise the OCS is only updated once the interrupt handler processes the CQE, and a delayed or lost interrupt would make the poll time out and escalate to a host reset although the request has already been cleaned up. The OCS is still read under hwq->cq_lock because the interrupt handler may reap the CQE between the reap and the read. ufshcd_compl_one_cqe() updates the OCS under that lock before it sets cmd->result and calls scsi_done(). Without the lock, cleanup could observe the new OCS and return while the completion is still running. The abort could then finish the command and a retry could reuse the same reserved request before the pending scsi_done() call, which would then complete the retry prematurely. Fixes: 8d7290348992 ("scsi: ufs: mcq: Add supporting functions for MCQ abort") Signed-off-by: Kiwoong Kim Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Link: https://patch.msgid.link/a1af44cd90dca0dd8a9a06d09a254a4e7e0861b2.1793938245.git.kwmad.kim@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 30bdadc9aa3a684cd634c7fa49740b1151e7b2e5 Author: Kiwoong Kim Date: Fri Nov 6 13:12:46 2026 +0900 scsi: ufs: core: Skip ABORT TASK for device management commands In MCQ mode, ufshcd_mcq_abort() falls through to ufshcd_try_to_abort_task() for all timed-out commands. However, device management commands (query, NOP) use reserved requests and are not SCSI I/O commands. The ABORT TASK task management function is designed for SCSI I/O UPIUs and is not applicable to device management UPIUs. This is only reachable since device management commands were converted to scsi_get_internal_cmd(); before that, a timed-out query was handled by ufshcd_wait_for_dev_cmd() -> ufshcd_clear_cmd() and never reached ufshcd_try_to_abort_task(). Fix this by checking ufshcd_is_scsi_cmd() in ufshcd_try_to_abort_task(). For a reserved (device management) command, skip the TM path and call ufshcd_clear_cmd() directly. ufshcd_abort() now calls ufshcd_try_to_abort_task() for every request, so its separate reserved-request branch is removed. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Reported-by: Bart Van Assche Signed-off-by: Kiwoong Kim Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/ab14d2f1414fa1a0a396f160abf8c27c404b4ec4.1793938245.git.kwmad.kim@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 04feb5fd2c23894ebc2cdaf4a4cc38b8667b17ac Author: Dongdong Hao Date: Wed Nov 4 17:28:08 2026 +0800 scsi: leapraid: Fix init_cmd_priv error handling leapraid_init_cmd_priv() ignores the return value of leapraid_internal_init_cmd_priv() and always returns success. If dma_pool_alloc() fails, io_tracker->chain remains NULL, but the SCSI midlayer considers the command successfully initialized. A subsequent I/O requiring more than LEAPRAID_SGL_INLINE_THRESHOLD DMA-mapped scatter-gather entries dereferences the NULL chain buffer while building the chained SGL, causing a kernel crash. Return the result of leapraid_internal_init_cmd_priv() so that allocation failures propagate to the SCSI midlayer and abort initialization of the affected request. Reviewed-by: Damien Le Moal Signed-off-by: Dongdong Hao Link: https://patch.msgid.link/20261104092808.206067-1-doubled@leap-io-kernel.com Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Martin K. Petersen (Oracle) commit c14818f4d2b46a67fa0d2fd8fd5ef3532245f07a Author: Bart Van Assche Date: Fri Oct 30 15:42:39 2026 -0700 scsi: core: Limit retries of commands that receive UNIT ATTENTION Fail non-removable commands in scsi_io_completion_action() on UNIT ATTENTION if retries exceed max(cmd->allowed, 3). This bounds the number of retries of commands for which scsi_decide_disposition() exhausted the retries or that have been finished by the error handler, e.g. because a target keeps reporting UNIT ATTENTION after recovery. Since scmd->retries is not incremented for failfast commands on this code path, failfast commands are retried until the command runtime limit is exceeded, as before. Signed-off-by: Bart Van Assche Tested-by: Alexey Charkov Link: https://patch.msgid.link/959f1c7628af83cd184ac51f35e38d654b261069.1793400000.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 49da33f609929db6f6c3b8567d0e0cca6f9ae182 Author: Bart Van Assche Date: Fri Oct 30 15:42:38 2026 -0700 scsi: core: Escalate persistent UNIT ATTENTION conditions Recover from persistent UNIT ATTENTION conditions in the SCSI midlayer instead of maintaining a per-device quirk list for targets such as BIWIN BWU2A05* UFS devices that fail to clear power-on or reset UNIT ATTENTION on WRITE commands while clearing it on commands such as TEST UNIT READY, READ, and SYNCHRONIZE CACHE. If a non-removable block request that is not failfast receives the same UNIT ATTENTION repeatedly, retry it twice and invoke the error handler thereafter, instead of letting scsi_io_completion_action() retry uncounted until the command runtime limit is exceeded. The error handler clears the UNIT ATTENTION by sending TEST UNIT READY. Track this with a dedicated per-command counter and the additional sense code of the most recent UNIT ATTENTION instead of scmd->retries. scmd->retries is also incremented for other retry reasons and by the error handler, and a target may report multiple queued UNIT ATTENTION conditions with different additional sense codes. On most architectures the new fields occupy an existing hole in struct scsi_cmnd. Limit the number of error handler invocations for commands with unlimited retries since scsi_eh_flush_done_q() does not limit these. Only apply this escalation when the sense data is evaluated by scsi_decide_disposition() and leave the behavior of the exported scsi_check_sense() function unchanged. libata calls scsi_check_sense() from its own error handler, which translates FAILED into an ATA port reset and never sends TEST UNIT READY. Reported-by: Alexey Charkov Closes: https://lore.kernel.org/linux-scsi/20261028-biwin-tua-quirk-v1-1-767a12c9b9cc@flipper.net/ Signed-off-by: Bart Van Assche Tested-by: Alexey Charkov Link: https://patch.msgid.link/5c34851674a67879e175251b9bfe6ccf091e390a.1793400000.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit d54e68b5c31cbfb108c1f22ec21bdf43c5133e0e Author: Bart Van Assche Date: Fri Oct 30 15:42:37 2026 -0700 scsi: core: Clear UNIT ATTENTION conditions with TEST UNIT READY Some targets, e.g. BIWIN BWU2A05* UFS devices, fail to clear power-on or reset UNIT ATTENTION conditions on WRITE commands while clearing these on commands like TEST UNIT READY, READ, and SYNCHRONIZE CACHE. Add scsi_eh_clear_ua() to scsi_eh_ready_devs() ahead of device reset so that the error handler sends TEST UNIT READY to consume a stuck UNIT ATTENTION and verifies with a follow-up TEST UNIT READY that the condition cleared before requeueing affected commands. Allow a few additional TEST UNIT READY attempts for queued UNIT ATTENTION conditions and busy devices, delay retries, and honor the error handler deadline. Save and restore scmd->sense_buffer across scsi_send_eh_cmnd() so that the original sense data remains intact while filtering work_q and if retries are later exhausted. Log a rate-limited message when a persistent UNIT ATTENTION is cleared to make it possible to identify misbehaving devices. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/444e78b0fa892e8854bee89f341824d67000d968.1793400000.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 099fb3376bb73c29457782d917a3b68d846a9e87 Author: Bart Van Assche Date: Fri Oct 30 15:42:36 2026 -0700 scsi: core: Simplify scsi_eh_ready_devs() Replace the nested if-statements in scsi_eh_ready_devs() with a single if-statement that combines the conditions with the && operator. This reduces the indentation level and makes it easier to insert additional recovery steps. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/de1a210fb52adaefd818ed68eb5e7678a004762e.1793400000.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit b7545895b1c97b8fd0201ee6eac9cbeb57f1e3c5 Author: Bart Van Assche Date: Fri Oct 30 15:42:35 2026 -0700 scsi: core: Introduce scsi_cmd_needs_stu() Introduce scsi_cmd_needs_stu() and use it in scsi_eh_stu() instead of testing scsi_check_sense(scmd) == FAILED. This makes it explicit that START UNIT is only sent for LU_NOT_READY_INITIALIZING_COMMAND_REQUIRED and prevents that the error handler reports sense data a second time. This patch prepares for making scsi_decide_disposition() escalate persistent UNIT ATTENTION conditions to the error handler. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/c35a3b27958cb93c26c1ccecccd572c54da448e4.1793400000.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit c84374cf4d2cb0c6efff91f7a37e85656cbbd593 Author: Shawn Lin Date: Thu Oct 29 15:24:55 2026 +0800 scsi: ufs: rockchip: Improve RX noise immunity Program VND_RX_SAVE_DET_CTRL for each RX lane to raise the receiver's tolerance against short transients on the incoming signal, as recommended by the Rockchip PHY team. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/20261029151030.1.I61cd43e660b146e49d4380a754e936270e5fb6a1@changeid Signed-off-by: Martin K. Petersen (Oracle) commit 9eb89611d95914e47cec62826e4000396df0f953 Author: Stanley Jhu Date: Thu Oct 29 15:08:40 2026 +0800 scsi: ufs: hwmon, debugfs: Propagate runtime PM resume errors ufs_hwmon_read(), ufs_hwmon_write(), and ufs_debugfs_get_user_access() resume the UFS device W-LUN with ufshcd_rpm_get_sync() and ignore its return value. For example, for a hwmon temperature read: 1. The W-LUN is runtime suspended. 2. User space reads temp1_input of the UFS hwmon device. 3. ufs_hwmon_read() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_hwmon_read() sends an attribute query UPIU while the W-LUN is still suspended. ufs_hwmon_write() and the debugfs writers that use ufs_debugfs_get_user_access() (exception_event_mask and tx_eq_ctrl) follow the same sequence. Convert all three call sites to ufshcd_rpm_resume_and_get() and release hba->host_sem before returning the error, ahead of __acquire(ufs_debugfs) in ufs_debugfs_get_user_access(). Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Fixes: e88e2d32200a ("scsi: ufs: core: Probe for temperature notification support") Fixes: adbabdcf0db0 ("scsi: ufs: core: Add support to retrain TX Equalization via debugfs") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-6-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 2b8541edf7c43f0294c45d2e687bbc1288292f4e Author: Stanley Jhu Date: Thu Oct 29 15:08:39 2026 +0800 scsi: ufs: bsg: Abort ufs_bsg_request() when runtime resume fails ufs_bsg_request() resumes the UFS device W-LUN with ufshcd_rpm_get_sync() and ignores its return value: 1. The W-LUN is runtime suspended. 2. User space submits a BSG request. 3. ufs_bsg_request() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_bsg_request() dispatches the BSG command while the W-LUN is still suspended. Use ufshcd_rpm_resume_and_get() and jump to out_complete on error so the BSG job is completed via bsg_job_done() with the failure code without dropping an unacquired runtime PM reference. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-5-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 93891d1c486efcef2267c32e6e73ca2fd243704e Author: Stanley Jhu Date: Thu Oct 29 15:08:38 2026 +0800 scsi: ufs: sysfs: Propagate runtime PM resume errors All 14 ufshcd_rpm_get_sync() callers in ufs-sysfs.c resume the UFS device W-LUN and ignore the return value. For example, for a UFS descriptor read: 1. The W-LUN is runtime suspended. 2. User space reads a UFS descriptor attribute in sysfs. 3. ufs_sysfs_read_desc_param() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_sysfs_read_desc_param() sends a query UPIU while the W-LUN is still suspended. The other sysfs callers follow the same sequence. They send other query UPIUs, or read a host register in ufshcd_read_hci_reg(). Switch all 14 sysfs callers to ufshcd_rpm_resume_and_get() and return the error after releasing any held buffer and hba->host_sem. Fixes: aef80fd1da32 ("scsi: ufs: sysfs: Resume the proper SCSI device") Fixes: b9d104465a6c ("scsi: ufs: Prepare to add HCI capabilities sysfs") Fixes: 600edc6620a4 ("scsi: ufs: sysfs: Make max_number_of_rtt read-write") Fixes: 6c4148ce7cc1 ("scsi: ufs: wb: Add explicit flush sysfs attribute") Fixes: 500d4b742e0c ("scsi: ufs: core: Add WB buffer resize support") Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support") Fixes: 1fd2e77b8897 ("scsi: ufs: core: Add device level exception support") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-4-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cbab12e5b4a7f49d5add4301de275351269cd431 Author: Stanley Jhu Date: Thu Oct 29 15:08:37 2026 +0800 scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper ufshcd_clkscale_enable_store() and ufshcd_auto_hibern8_update() resume the UFS device W-LUN with ufshcd_rpm_get_sync() and ignore its return value. For clkscale_enable: 1. The W-LUN is runtime suspended and clock scaling is disabled. 2. User space writes 1 to clkscale_enable. 3. ufshcd_clkscale_enable_store() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufshcd_clkscale_enable_store() enables clock scaling and resumes devfreq while the W-LUN is still suspended. For auto_hibern8: 1. The W-LUN starts a runtime suspend. 2. User space writes a new value to auto_hibern8. 3. ufshcd_auto_hibern8_update() sees that the W-LUN is not yet suspended and calls ufshcd_rpm_get_sync(). 4. ufshcd_rpm_get_sync() waits for the runtime suspend to finish and then runs the W-LUN runtime resume. 5. The W-LUN runtime resume fails and the W-LUN stays suspended. 6. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 7. ufshcd_auto_hibern8_update() writes REG_AUTO_HIBERNATE_IDLE_TIMER while the W-LUN is still suspended. Add ufshcd_rpm_resume_and_get() wrapping pm_runtime_resume_and_get() so failed resumes drop the usage reference automatically, and return early in ufshcd_clkscale_enable_store() and ufshcd_auto_hibern8_update() when it fails. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit ebf5cab0dd223a36a09742a91be4fea97e46c816 Author: Stanley Jhu Date: Thu Oct 29 15:08:36 2026 +0800 scsi: ufs: core: Restore jiffies conversion of device management timeouts Before commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()"), ufshcd_wait_for_dev_cmd() converted the millisecond timeout with msecs_to_jiffies() before waiting for the command. That commit moved the timeout to the block layer and assigns the millisecond value to rq->timeout as is, but rq->timeout is in jiffies. A 1500 ms query timeout (QUERY_REQ_TIMEOUT_DEFAULT) becomes 6 s with CONFIG_HZ=250 and 15 s with CONFIG_HZ=100, and NOP_OUT_TIMEOUT and ADVANCED_RPMB_REQ_TIMEOUT grow the same way. Restore the conversion with msecs_to_jiffies(). Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cae8db99f3956e6446827ae4a9605a1ed815772b Author: Dmitry Bogdanov Date: Tue Oct 27 21:01:23 2026 +0300 scsi: target: iscsi: Fix hanging WRITE_PENDING commands When Data comes for an aborted WRITE command in WRITE_PENDING state it is silently received and the command does not pass to the target. That leads to hanging of other session with LUN_RESET aborting that command. Pass the aborted WRITE commands when all Data has been gathered. Signed-off-by: Dmitry Bogdanov Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Link: https://patch.msgid.link/20261027180123.13163-3-d.bogdanov@yadro.com Signed-off-by: Martin K. Petersen (Oracle) commit 94196cd3413fba6cf6d1f71d6de401e56caaf29b Author: Dmitry Bogdanov Date: Tue Oct 27 21:01:22 2026 +0300 scsi: Revert "scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands" This reverts commit d5869dae5080e976d4b03cc33eb7ceb527f242bf as it introduces double completion of the command and other issues. Signed-off-by: Dmitry Bogdanov Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Link: https://patch.msgid.link/20261027180123.13163-2-d.bogdanov@yadro.com Signed-off-by: Martin K. Petersen (Oracle) commit 6da1bc55c060bec3163b0e6077f3ac9641f8100c Author: Stanley Jhu Date: Thu Oct 29 15:08:30 2026 +0800 scsi: ufs: core: Keep clock-gating hold on failed W-LUN runtime resume 1. __ufshcd_wl_suspend() takes one ufshcd_hold() reference and sets hba->clk_gating.is_suspended while the UFS device W-LUN enters RPM_SUSPENDED. 2. Since commit eef1d74bf88f ("PM: runtime: Only set runtime_error on suspend callback failures"), a failed runtime resume (for example START STOP UNIT completing with an error) leaves the W-LUN in RPM_SUSPENDED with power.runtime_error == 0, while __ufshcd_wl_resume() already clears hba->clk_gating.is_suspended and calls ufshcd_release(). 3. The next W-LUN runtime resume runs __ufshcd_wl_resume() again without an intervening suspend and calls ufshcd_release() a second time, dropping a reference it does not own and underflowing hba->clk_gating.active_reqs on UFSHCD_CAP_CLK_GATING hosts. Keep hba->clk_gating.is_suspended and the suspend hold across a failed W-LUN runtime resume, so the hold stays paired with the W-LUN RPM_SUSPENDED state and the next successful resume releases it. Fixes: eef1d74bf88f ("PM: runtime: Only set runtime_error on suspend callback failures") Cc: stable@vger.kernel.org # v7.3+ Signed-off-by: Stanley Jhu Reviewed-by: Brian Norris Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040002.2100002-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 2b2bb55990cf1d9dbd59ee326d545798061fce97 Author: James Houghton Date: Mon Oct 26 21:52:17 2026 +0000 scsi: bsg: Don't copy sense data to user memory when canceled scsi_bsg_uring_task_cb() copies the sense data to the submitter's response_addr with copy_to_user(). It runs as io_uring task work, but io_uring may also run it with tw.cancel set from other contexts when the submitting task can't run it: from a kworker when the submitting task has exited (io_tctx_fallback_work()), or from io_cancel_local_task_work() when a DEFER_TASKRUN ring is torn down. In a kworker, current->mm is NULL, and the copy does not reliably fail: the user half of the address space belongs to whatever mm happens to be lazily loaded, if any, so up to max_response_len bytes of sense data may be written into an unrelated process. Don't copy the sense data when the task work is canceled, and complete the command with -ECANCELED. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Signed-off-by: James Houghton Reviewed-by: Jens Axboe Link: https://patch.msgid.link/20261026215226.3713941-2-jthoughton@google.com Signed-off-by: Martin K. Petersen (Oracle) commit c78b78166c55ebd6ae0b378499abd519aee7a966 Author: Matt Wang Date: Mon Oct 19 14:29:58 2026 +0800 scsi: vmw_pvscsi: Add support for ARM64 architecture This change adds PVSCSI support for the ARM64 architecture, restricted to little endian and 4K memory page size. Barrier usage is updated from compiler barriers, which were sufficient on x86, to the appropriate DMA barriers. Signed-off-by: Matt Wang Reviewed-by: Vishal Bhakta Link: https://patch.msgid.link/20261019062959.426900-1-matt.wang@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit a3d959d2778f22b44c2df52cb70e78811c0e739e Author: Matt Wang Date: Wed Sep 30 07:15:39 2026 +0800 scsi: vmw_pvscsi: Clamp on e->dataLen in pvscsi_complete_request() When calculating the residual bytes, clamp dataLen to the buffer length before the subtraction. This prevents an overflow if the device sends a larger value than expected. Signed-off-by: Matt Wang Link: https://patch.msgid.link/20260929231539.630963-1-matt.wang@broadcom.com Fixes: 851b164231d1 ("[SCSI] vmw_pvscsi: SCSI driver for VMware's virtual HBA.") Signed-off-by: Martin K. Petersen (Oracle) commit 6e862335a8d3a3c8bfc8488dc1c6fa81b83a83ee Author: Matt Wang Date: Wed Sep 30 07:14:59 2026 +0800 scsi: vmw_pvscsi: Add boundary check for cmd_map access The context value provided by the device in a completion is used to index into cmd_map to find the command that was completed. To prevent out of bounds access or completion of an inactive context, check that the context value is in-bounds and that it maps to an active context. Signed-off-by: Matt Wang Link: https://patch.msgid.link/20260929231459.630938-1-matt.wang@broadcom.com Fixes: 851b164231d1 ("[SCSI] vmw_pvscsi: SCSI driver for VMware's virtual HBA.") Signed-off-by: Martin K. Petersen (Oracle) commit b8d0bb6a8ba0d3878940a914a19336844101867b Author: Shao Mingyin Date: Mon Oct 26 19:52:45 2026 +0800 scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store tcmu_set_data_pages_per_blk() only validates the upper bound of the value parsed from data_pages_per_blk=. Zero passes that check and is then used as the divisor when computing udev->max_blocks: divide error: 0000 [#1] SMP ... tcmu_set_data_pages_per_blk tcmu_configure_device Reject non-positive values, as the neighbouring max_data_area_mb and cmd_ring_size setters already do. Fixes: 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Reviewed-by: Bodo Stroesser Link: https://patch.msgid.link/20261026195245337ktSXy9G17VCcXyw760g9s@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit cdf4b87a18cb6a0ee26865cb1b7b5660a491d302 Author: Yuanhe Shu Date: Mon Oct 26 20:41:38 2026 +0800 scsi: target: Verify the iSCSI ISID is null-terminated iscsi_parse_pr_out_transport_id() returns the ISID of a FORMAT CODE 01b TransportID as a pointer into the PERSISTENT RESERVE OUT parameter list, lowercased in place and never null-terminated. spc4r37 Table 508 requires the field to be null-terminated, but a non-conforming initiator can omit the NULL; when the ISID ends at the end of the received buffer, the pointer is not a C string. The registration code still consumes it as one: strcmp() in __core_scsi3_locate_pr_reg() and in the REGISTER AND MOVE path, and snprintf("%s") in __core_scsi3_do_alloc_registration(), which also reads its first 8 bytes unconditionally with get_unaligned_be64() - a NUL check does not bound that read. When the parameter list spans more than one page, transport_kmap_data_sg() maps it with vmap(), and the over-read walks off the end of the mapping into the vmalloc() guard page and oopses. Reproduced with a PR OUT REGISTER + SPEC_I_PT parameter list of exactly 8192 bytes whose final TransportID carries a 12-byte ISID without a terminating NUL: BUG: unable to handle page fault for address: ffffc9000138c000 RIP: 0010:strcmp+0xc/0x30 Call Trace: __core_scsi3_locate_pr_reg+0xd3/0x120 [target_core_mod] core_scsi3_decode_spec_i_port+0x8fc/0x13a0 [target_core_mod] core_scsi3_emulate_pro_register+0x73c/0x900 [target_core_mod] ... iscsi_target_rx_thread+0xef/0x1d0 [iscsi_target_mod] With a single-page parameter list the buffer is a kmap() direct mapping, so the over-read continues into the physically adjacent page instead of faulting. snprintf("%s") then copies whatever follows the ISID in memory into pr_reg_isid, and PR IN READ FULL STATUS reports the registration back to any initiator, turning the over-read into an info leak of kernel heap contents. Reproduced with a 4096-byte parameter list whose last TransportID ends at the end of the buffer with a 4-byte ISID and no NUL, interleaved with I/O to populate adjacent pages: the READ FULL STATUS response returned the ISID as "0xleak" followed by raw bytes that were not part of the parameter list. The snprintf() into pr_reg_isid[PR_REG_ISID_LEN] caps the echoed ISID at 15 characters, so at most 11 bytes past the buffer are leaked per command, but the PR OUT command is not rate limited. Any initiator that can send PR OUT to an iSCSI-exported LUN can trigger either variant, including a guest via vhost-scsi. Require 8 bytes to remain after the ",i,0x" separator, and a NUL inside the rest of the descriptor, before the ISID pointer is returned. REGISTER AND MOVE fails with TCM_INVALID_PARAMETER_LIST; on SPEC_I_PT no target port claims the malformed TransportID, and the command fails the same way. Fixes: d04a179085c2 ("scsi: target: Bound PR-OUT TransportID parsing to the received buffer") Reported-by: kitta Reported-by: sashiko AI review Link: https://lore.kernel.org/r/sashiko-outbox-184760@kernel.org/ Cc: stable@vger.kernel.org Cc: Bryam Vargas Cc: John Garry Assisted-by: LLM Signed-off-by: Yuanhe Shu Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Link: https://patch.msgid.link/20261026124138.2708365-1-xiangzao@linux.alibaba.com Signed-off-by: Martin K. Petersen (Oracle) commit ffb7b533a47906b96166eec4b7eaa4199b7a7462 Author: Yingjie Wang Date: Fri Oct 23 16:23:06 2026 +0000 scsi: bsg: Report io_uring data copyback failures scsi_bsg_uring_task_cb() discards the result of blk_rq_unmap_user(). For a data-in command that uses a bounce buffer, the task work can therefore post a CQE with res == 0 despite a copyback failure. Use the unmap result as the CQE status. A later sense-buffer copy failure continues to take precedence. On x86_64, a raw BSG INQUIRY into an unaligned anonymous PROT_NONE mapping posted a CQE with res == 0 in 20/20 runs before this change and res == -EFAULT in 20/20 runs afterward. Writable controls succeeded in 20/20 runs on both kernels. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang Reviewed-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/0b35d2d46bf8ff9f2dbba83ae093d17351e950e9.1792772194.git.x-professor@outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit a52f2ad45726d788755b525adcf51f65a6b836ff Author: Yingjie Wang Date: Fri Oct 23 16:23:04 2026 +0000 scsi: bsg: Report synchronous data copyback failures scsi_bsg_sg_io_fn() ignores the result of blk_rq_unmap_user(). For a data-in command that uses a bounce buffer, unmapping copies the completed data to userspace. If that copy fails, SG_IO can report success despite the copyback failure. Capture the unmap status. Preserve an earlier sense-buffer copy error and otherwise return the data copyback error. This matches the error precedence used by scsi_complete_sghdr_rq(). On x86_64, a virtio-scsi INQUIRY with an unaligned PROT_NONE destination made ioctl() return 0 in 20/20 runs before this change and return -1 with errno EFAULT in 20/20 runs afterward. Writable controls succeeded in 20/20 runs on both kernels. Fixes: 10e8855b9451 ("bsg: add SG_IO to SG v4") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang Reviewed-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/2561d633cc8cef513d75eb1df260046a4971e783.1792772194.git.x-professor@outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit 5d5913710c81eed6fa275b6a24773059d9dbfdfa Author: Jia Jia Date: Wed Oct 21 17:43:34 2026 +0800 scsi: target: Validate REGISTER AND MOVE TransportID length REGISTER AND MOVE has a 24-byte parameter-list header followed by a TransportID. A 24-byte parameter list with a zero TransportID length passes the existing tid_len + 24 check, then the handler reads buf[24] for the TransportID protocol identifier, one byte past the received parameter list. A TransportID is at least 24 bytes. Reject shorter TransportIDs and compare the declared length with the bytes following the header before reading buf[24]. A malformed PR OUT sent through vhost-scsi triggered this read on a KASAN kernel. The command is now rejected with INVALID PARAMETER LIST before buf[24] is accessed. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Jia Jia Link: https://patch.msgid.link/20261021094334.198599-1-physicalmtea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit d58e6d962e5b59297be24d908f41af93f20ec11f Author: Vincent YUE Date: Wed Oct 21 07:08:56 2026 +1000 scsi: mpt3sas: Register devices during SANITIZE A SAS disk being sanitized responds to TEST UNIT READY with NOT READY, ASC 0x04, ASCQ 0x1b. mpt3sas discovery maps this sense to DEVICE_START_UNIT and issues START UNIT repeatedly. The drive stays NOT READY until the sanitize operation completes, causing discovery to exhaust its retry budget and decline SCSI device registration. Allow registration only for the SANITIZE IN PROGRESS sense, so sd/sg can expose the target while retaining its actual NOT READY state. All other sense dispositions are unchanged. On an LSI SAS3008 with an HGST HUH728080AL4200, unpatched Linux 7.2.11 retried discovery 145 times without registering the device. Linux 6.18.55 registered the same sanitizing drive. With the equivalent 7.2.11 fix the disk registered as /dev/sda (0 B) and /dev/sg0 while TEST UNIT READY still reported 02/04/1b and 47.32% SANITIZE progress. Another SAS drive continued to enumerate. This updated variant uses the named 0x041b sense constant introduced in newer kernels. It passed static review on the current SCSI for-next branch but has not been independently boot-tested there. Fixes: aee682fad6cd ("scsi: mpt3sas: Improve device discovery and readiness handling for slow devices") Assisted-by: LLM Signed-off-by: Vincent YUE Link: https://patch.msgid.link/20261020210856.42835-1-vince@palmit.com.au Reviewed-by: Laurence Oberman Signed-off-by: Martin K. Petersen (Oracle) commit 503e6172fa74da6b4944ece458f5534681e51d21 Author: Adrián García Casado Date: Tue Oct 20 21:59:34 2026 +0200 scsi: libsas: Add __printf attribute to sas_ata_printk() sas_ata_printk() formats its variadic arguments via struct va_format and %pV before passing them to printk(). Because %pV hides the format string from the compiler, GCC does not suggest the format attribute under -Wsuggest-attribute=format, and callers do not get compile-time format string validation. Add the __printf(3, 4) attribute to sas_ata_printk() to enable compile-time format string checking for its callers. Signed-off-by: Adrián García Casado Reviewed-by: John Garry Link: https://patch.msgid.link/20261020195934.250768-1-adriangarciacasado42@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 6a6e7d7230cd4e0a6c003bae5b85bf37a1e77b94 Author: Yu Zhang Date: Wed Oct 14 11:37:46 2026 +1000 scsi: target: Fix demo-mode dynamic ACL dev-entry UAF vs LUN teardown A demo-mode (generate_node_acls=1) login that allocates a dynamic NodeACL populates that ACL's per-LUN dev entries in core_tpg_add_node_to_devs() *before* the ACL is linked onto tpg->acl_node_list by target_add_node_acl(): core_tpg_check_initiator_node_acl(): ... core_tpg_add_node_to_devs(acl, tpg, NULL); /* builds deves */ target_add_node_acl(acl); /* only now listed */ The LUN teardown sweep, core_clear_lun_from_tpg(), enumerates only tpg->acl_node_list, so a dev entry whose ACL is still in the window above is invisible to the sweep and is never disabled. It is left on the se_lun->lun_deve_list after core_tpg_remove_lun() frees the se_lun; when the same unpacked_lun is later re-added and the se_lun is reallocated at the same address, the stale dev entry is rediscovered by target_nacl_find_deve() and core_enable_device_list_for_node() corrupts lun_deve_list: BUG: KASAN: slab-use-after-free ... core_enable_device_list_for_node+0x5ce/0x880 core_tpg_add_node_to_devs+0x169/0x190 core_dev_add_lun+0x146/0x190 target_fabric_port_link+0xe9/0x1b0 configfs_symlink+0x381/0xae0 __x64_sys_symlink+0x55/0x80 The demo-mode login path that drives the ACL/dev-entry creation is reachable by an unauthenticated initiator; the colliding LUN add/remove is a local configfs operation. Commit 49cb77e297dc ("target: Avoid mappedlun symlink creation during lun shutdown") introduced se_lun->lun_shutdown and guarded the *explicit* ACL MappedLUN path (target_fabric_mappedlun_link()), but the demo-mode automatic path, core_tpg_add_node_to_devs() -> core_enable_device_list_for_node(), was never given the equivalent guard, and the publish-after-populate ordering in core_tpg_check_initiator_node_acl() was left unchanged. Fix it in three cooperating parts: 1) Publish the dynamic NodeACL onto acl_node_list *before* creating its dev entries, so the teardown sweep can observe them. 2) Refuse to attach a dev entry to an se_lun that is shutting down, checked under nacl->lun_entry_mutex -- the same lock the sweep takes -- so once the sweep has passed an ACL any later enable for that LUN observes lun_shutdown and skips it. 3) In core_enable_device_list_for_node(), insert the new dev entry onto lun->lun_deve_list while still holding nacl->lun_entry_mutex, in both the replace and the new-entry branch. Previously the entry was added to nacl->lun_entry_hlist under the mutex but to lun->lun_deve_list only after dropping it; with the ACL now published early, the sweep could take the mutex in that gap, find the entry on the hlist, core_disable_device_list_for_node() it (list_del() on the not-yet- linked lun_link succeeds and the entry is freed), and then the enable would list_add_tail() the freed entry back onto lun_deve_list. Linking both lists under the mutex makes enable and the sweep mutually exclusive, closing that window. core_tpg_add_node_to_devs() already ignores the return value of core_enable_device_list_for_node(), so a shutting-down LUN is simply skipped. Cc: stable@vger.kernel.org Fixes: 49cb77e297dc ("target: Avoid mappedlun symlink creation during lun shutdown") Signed-off-by: Yu Zhang Tested-by: Yu Zhang Link: https://patch.msgid.link/20261014013746.46705-1-yuz08559@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ec6671b137de06f0345962fb8091466b7d56a96 Author: Matthew Whitehead Date: Tue Sep 29 10:45:28 2026 -0400 scsi: aha1542: Remove unneeded scsi_dma_unmap() call aha1542 never DMA maps the command's scatterlist. Data is bounced through a per-command buffer allocated with dma_alloc_coherent() in aha1542_init_cmd_priv(), the adapter is programmed with acmd->data_buffer_handle, and the payload is copied to and from the request segments in aha1542_queuecommand() and aha1542_free_cmd(). The scsi_dma_unmap() call left in aha1542_free_cmd() therefore unmaps a scatterlist that was never mapped. With CONFIG_DMA_API_DEBUG enabled this results in: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=0 bytes] Remove the call. Verified by testing on real hardware. Fixes: 2f2fef022c3e ("aha1542: use a local bounce buffer") Suggested-by: Laurence Oberman Assisted-by: LLM Signed-off-by: Matthew Whitehead Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260929144528.7061-1-tedheadster@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit ba80a742b3e184b1af8f1ce636105e67f7cedb14 Author: Bart Van Assche Date: Fri Sep 25 11:25:43 2026 -0700 scsi: BusLogic: Prepare for enabling lock context analysis Document locking requirements with __must_hold() annotations to prepare the BusLogic driver for enabling compiler-based lock context analysis. Cc: Khalid Aziz Signed-off-by: Bart Van Assche Acked-by: Khalid Aziz Link: https://patch.msgid.link/abe0bc09b63eb55f278a883b65b881b94ce1c31b.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit b54bd8da110dd9efb058d68b04b50d9341f9f090 Author: Bart Van Assche Date: Fri Sep 25 11:25:42 2026 -0700 scsi: BusLogic: Pass the host pointer directly to several functions Pass the struct Scsi_Host pointer directly to multiple functions. This prepares the BusLogic driver for enabling compiler-based lock context analysis. No functionality has been changed. Cc: Khalid Aziz Signed-off-by: Bart Van Assche Acked-by: Khalid Aziz Link: https://patch.msgid.link/09e99ec9c6fa24ee5fe3c47110c88a1be076e01a.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 6b2ff2b3eafa381db9b4c8a6ed98b353b2a09f39 Author: HOYOUNG SEO Date: Tue Oct 27 20:03:57 2026 +0900 scsi: ufs: core: Change the error check sequence for auto hibern8 Auto-hibern8 enter and exit are performed by the host controller without a UIC command, and the auto-hibern8 idle timer only runs while no UIC command is outstanding. An auto-hibern8 error (IS.UHES or IS.UHXS) is therefore usually reported while hba->active_uic_cmd is NULL. Since commit fcd8b0450a9a ("scsi: ufs: core: Make ufshcd_uic_cmd_compl() easier to analyze"), ufshcd_uic_cmd_compl() returns early when hba->active_uic_cmd is NULL, before ufshcd_is_auto_hibern8_error() is called. Such auto-hibern8 errors are no longer recorded in hba->errors, so ufshcd_check_errors() is not called for them and the error handler is not scheduled. Check for auto-hibern8 errors before checking for an active UIC command, as was done before that commit, but keep returning early when there is no active UIC command so that a NULL cmd is never dereferenced. Only report the missing UIC command if no auto-hibern8 error was found. Fixes: fcd8b0450a9a ("scsi: ufs: core: Make ufshcd_uic_cmd_compl() easier to analyze") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: HOYOUNG SEO Reviewed-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261027110357.3649301-1-hy50.seo@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 8a832fb632da303cdf0704e0d56722ec47799f19 Author: Giuseppe Piscitelli Date: Tue Oct 27 11:08:50 2026 +0100 scsi: core: Balance the pseudo target reap reference With memory allocation profiling enabled, unloading scsi_debug reports allocations left at module unload. A stock Linux 7.2.11 VM without OpenZFS emitted the following on each of three load/unload cycles: [ 1.644665] drivers/scsi/scsi_debug.c:8863 module scsi_debug func:sdebug_add_host_helper has 1024 allocated at module unload [ 1.656260] drivers/scsi/scsi_debug.c:1261 module scsi_debug func:sdebug_target_alloc has 16 allocated at module unload scsi_alloc_target() supplies a reap reference for its caller. The SCSI device initializer takes another reference, which device removal drops. scsi_get_pseudo_sdev() drops its caller reference only when device allocation fails. On success the target cannot be destroyed, retaining its driver-private data and its parent host and adapter. Drop the caller reference in the common cleanup path, as the other scsi_alloc_target() callers do. Fixes: d630fbf6fc8c ("scsi: core: Support allocating a pseudo SCSI device") Signed-off-by: Giuseppe Piscitelli Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261027100859.1031135-1-ooonea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 34c99ce2993971712d89010a948d2f650687b796 Author: Giuseppe Piscitelli Date: Mon Oct 26 21:23:41 2026 +0100 scsi: scsi_debug: Drain target cleanup before module exit Target destruction queues cleanup in an exclusive async domain. The module loader's async_synchronize_full() does not wait for exclusive domains. Wait for target cleanup after removing the hosts and before removing the debugfs root and returning from module exit. Fixes: b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs failure") Signed-off-by: Giuseppe Piscitelli Link: https://patch.msgid.link/20261026202342.668361-1-ooonea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit f057a8bfeb6ff89c65e95540b8700a53c66d4a31 Author: Andrew Luebke Date: Mon Oct 26 10:20:32 2026 -0700 scsi: aic79xx: Fix NULL pointer dereference in device reset Since commit c67e63800446 ("scsi: aic79xx: Do not reference SCSI command when resetting device") the device reset SCB has no SCSI command, but ahd_linux_dev_reset() still sets its residual, and ahd_abort_scbs(), which completes it, sets its status. Seen on an AIC-7902 when a failing disk triggered a device reset, which killed the SCSI error handler: BUG: kernel NULL pointer dereference, address: 0000009c EIP: ahd_linux_dev_reset.cold+0xee/0x26e Add NULL command checks to the accessors in aic79xx_osm.h. Also skip autosense for an SCB without a command and complete it with ahd_done() right away: the REQUEST SENSE path can clear SCB_DEVICE_RESET, after which ahd_done() would dereference the missing command. Fixes: c67e63800446 ("scsi: aic79xx: Do not reference SCSI command when resetting device") Cc: stable@vger.kernel.org Reviewed-by: Hannes Reinecke Signed-off-by: Andrew Luebke Assisted-by: LLM Link: https://patch.msgid.link/20261026172032.749756-1-andrew.luebke@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 696bdfc58975fbc70d2e2347a74e0b562e7e2494 Author: Imre Kaloz Date: Mon Oct 26 14:14:32 2026 +0100 scsi: aic7xxx: Use default settings on the SGI O2 onboard controllers The SGI O2 firmware runs its onboard aic7880s without the Adaptec BIOS, so scratch RAM holds no settings. The left over BIOS path reads uninitialised bytes, and bad parity panics the boot. Use the defaults there with host ID 0. ahc_init() keeps the default host ID ahc_pci_config() chose, 7 on other PCI controllers, so only the O2 changes. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Imre Kaloz Link: https://patch.msgid.link/20261026131432.26065-1-kaloz@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9a2690eb4bbea8d7fbc3dfe478fca75fe956abb4 Author: Imre Kaloz Date: Tue Oct 13 11:42:53 2026 +0200 scsi: aic7xxx: Fix REQUEST SENSE allocation length on big-endian hosts The REQUEST SENSE length was taken from sg->len after the AHC_DMA_LAST_SEG flag was or-ed in and the value converted to little-endian, so the 8-bit field is 0x80 on big-endian hosts and the target is asked for 128 bytes into a 32-byte buffer. Use the buffer size, as aic79xx does. On an SGI O2 with a Fujitsu MAX3147NC, the sense data of its CHECK CONDITIONs during probe was lost. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Imre Kaloz Link: https://patch.msgid.link/20261013094253.2956-1-kaloz@kernel.org Signed-off-by: Martin K. Petersen (Oracle)